ldap-ad filtering at point of authentication

jbollom — Mon, 16 Jun 2014 06:15:46 GMT

Hey All,I'm just setting up Alfresco 4.2f for the first time and currently have ldap-ad setupI would like to restrict logins via group membership but i can not find any information on how to do thisEverything I read points to ldap sync filters but these details are not used when a user logs inOnly o

Re: ldap-ad filtering at point of authentication

nickburch — Thu, 26 Jun 2014 13:55:11 GMT

I don't think you can do it with only config. I believe you'll need to write some code

If you look in

alfresco/subsystems/Authentication/common-ldap-context.xml‍

you'll see the definition of the

authenticationComponent‍

based on

LDAPAuthenticationComponentImpl‍

which is what is used to authenticate users against LDAP. That in turn uses the config for

ldapInitialDirContextFactory‍

, and looks up users based on the

resolveDistinguishedName‍

LDAPUserRegistry‍

I think (though it's been a little while since I last delved into that code) that you'll need to provide a custom

LDAPUserRegistry‍

which extends from the default one, and have that provide an alternate

resolveDistinguishedName‍

method which adds in additional parts to the LDAP query. That will let you add in the extra constraints

topic Re: ldap-ad filtering at point of authentication in Alfresco Archive

ldap-ad filtering at point of authentication

Re: ldap-ad filtering at point of authentication